Biometric Breakdown

Privacy fears are now limiting the growth of biometrics as a fraud prevention tool, but some jurisdictions are considering the technology for security purposes instead.

When news broke that police used a video identification system to scan the faces of incoming football fans at the Super Bowl this year, reaction to the high-tech surveillance test spoke volumes about the state of biometric technology in the public sector today.

On one hand, many were amazed at the speed and accuracy of the system, which took less than a second to compare the faces of fans with a database containing thousands of digital images of known criminals and suspected terrorists.

On the other hand, many were outraged at what they saw as an invasion of privacy. The videotaping was done without the fans knowledge. Tampa police said the practice was similar to the use of cameras at busy intersections to nab speeding motorists, but privacy groups werent happy. Barry Steinhardt, associate director of the American Civil Liberties Union, told The Washington Post, "We are quickly moving to the point where law enforcement and the private sector will be able to identify us no matter where we go, no matter how anonymous we think we are."

For those who follow biometrics in state and local government, the reaction to the Super Bowl incident is no surprise. For years, law enforcement officials at the state and local level have been using biometric fingerprint scanning systems to identify criminals. Their success and accuracy caught the attention of other government agencies where fraud, perpetrated through false identification, has been a problem. Human service agencies wanted the technology to help stop welfare cheats. Departments of motor vehicles saw biometrics as a way to deter people from fraudulently applying for a drivers license.

Despite evidence that the technology works, only a handful of states are using biometrics to identify welfare recipients and drivers. "Interest in fingerprint scanning has dropped off," said David Mintie, project coordinator of Connecticuts digital imaging project in the Department of Social Services. "There are lots of concerns about privacy issues."

Others have said it more bluntly. In a recent issue of the Human Services User Group Newsletter, attorney Tim Schellberg wrote, "Misconceptions about biometrics, coupled with the privacy paranoia that has swept the nation, have caused legislative bodies to become more skeptical of biometric applications."

In short, interest in using biometrics to reduce fraud appears to be waning, not growing.

A Chilling Effect

When Los Angeles County began using finger imaging technology in 1991 to deter welfare fraud and then announced six months later that it had saved more than $5 million, just about everybody sat up and took notice. Original projections showed that the system had the potential of saving the county as much as $116 million (those figures were later downsized by 26 percent). By 1996, seven states were in various stages of planning, designing and implementing finger imaging systems for welfare recipients.

Today, however, little has changed. Eight states use finger-imaging systems to detect welfare fraud. Two more are developing systems and one state -- North Carolina -- has dropped plans to use the technology. Mintie ticks off several reasons why the technology has not caught on. First, privacy worries have had a chilling effect. "States are more fearful about opposition to the system, despite what they would gain from using it," he said.

As a result, approximately 15 states have introduced anti-biometric legislation in the past few years.

But other issues have also hurt the growth of biometrics in human services. The systems in place today were built without standards, according to Mintie. "What weve got now are a bunch of biometric silos," he explained.

Whats needed is a standard for minutia extraction, according to Mintie, so that states can share data. Minutia is the data attributed to the unique ridges that appear on a persons finger. Without that data exchange, interstate identification of welfare recipients to deter fraud -- a concern in the densely populated Northeast -- remains a pipedream.

Another nagging concern about these systems has been the amount of savings they actually generate. Biometric identification systems dont catch recipients in the act of double dipping, but deter fraud by scaring away potential abusers. Officials compare welfare application rolls before and after the system starts operating to measure whether cheaters have left the system and are no longer claiming benefits.

In 1999, Texas conducted a thorough examination of its finger imaging system and its impact on cost savings. The state, which has more than 975,000 clients, estimated that it saves between $6 million and $12 million annually by denying fraudulent claims for duplicate benefits. The savings were based on figures taken from several regional claims offices showing a less than one-half percent reduction in claims when applicants had to submit to finger imaging.

But actually proving these systems prevent fraud and save governments money has been difficult. In 1997, New York state conducted a study of its welfare finger imaging system and came to the conclusion that it was "statistically impossible to calculate how many people stay away [from welfare] because of finger imaging rather than other reasons. Caseloads were already declining sharply, including a rebounding economy, tough work requirements, anti-fraud home inspections and shortened eligibility."

Unclear numbers also killed what was seen as a promising application for biometrics in health care. Floridas Medicaid program proposed that pharmacies finger scan all Medicaid recipients who need a prescription filled. The goal was to improve identification and reduce the number of unauthorized prescriptions issued by pharmacies either through fraud or error, thereby saving the states Medicaid system millions of dollars.

But the Agency for Health Care Administration, which runs Medicaid in Florida, dropped the plan after it realized there was no real way to measure how the system would save money, according to Connie Ruggles, a senior management analyst. "We found there were other, more direct changes we could make that produced measurable savings."

Knowing how to accurately measure fraud prevention through finger imaging has been a shortcoming that needs to be addressed, according to Mintie. "People arent so sure about the savings," he said. "We need some standards in this area. Right now, states count prevention different ways."

Digital DMVs

When administrators of motor vehicle agencies took a look at biometrics for identifying license holders, they tackled the standards issue head on. AAMVAnet Inc., an affiliate of the American Association of Motor Vehicle Administrators, published a national standard for storing fingerprint minutia on license cards. According to Nathan Root, AAMVAnets standards program director, the standard is in widespread use and has made print matching fast, an important issue when searching a database that may contain millions of other prints.

Whats not so widespread is the use of biometrics to identify drivers. "The big hurdle is the privacy concern," said Root. "There are a lot of public fears about Big Brother."

Those fears stifled the use of biometrics just as it was getting started. A few years ago, six states mandated the use of fingerprints to identify drivers to reduce fraud and identity theft. Today, the number of states collecting drivers fingerprints hasnt changed.

Some states, including West Virginia and Illinois, have tried to reduce the invasiveness of fingerprinting by using facial scanning similar to the system used at the Super Bowl instead. In 1999, Illinois deployed the worlds largest drivers license facial recognition system, built by Viisage Technology. When complete, the database will contain more than 20 million images. West Virginia uses a facial recognition system built by Visionics and Polaroid to verify the identification of drivers whose licenses came up for reissue. West Virginias system has a database of more than 2 million facial images.

Because of their size, motor vehicle biometric systems are not cheap. Root says cost has been another contributing factor to the slow acceptance of biometrics at DMVs, but he expects that to change as prices continue to drop. He and other officials noted that scanners that cost as much as $2,200 in 1995 can be purchased today for less than $100.

Patching Security Holes

Although privacy concerns have thwarted government efforts to use biometrics to reduce fraud in programs involving citizens, it hasnt stopped one of the faster growing biometric applications: security. The military and national security agencies have been using different types of biometrics for security purposes for some time. The Immigration and Naturalization Service uses a recognition system based on hand geometry at border control checkpoints. Most recently, NASA has announced that it will test an Internet-based biometric security system for engineers and scientists who have to access secure networks from remote locations.

The use of biometrics for security in state and local government is virtually unknown. However, the city of Oceanside, Calif., became one of the first jurisdictions to do so when it recently replaced its password security system on its computer network with a finger scanning system. Nearly 1,200 government workers start the day by typing their name on the computer and putting their finger on a pad -- no bigger than a computer mouse -- that scans their fingerprint and logs them on to the network.

Authentication is quick -- 25 percent faster than typing in a password, according to Michael Sherwood, the citys IT director. But thats not the only reason they chose biometrics. "We have been able to cut down on the number of calls from staff who have lost their passwords or have had their account locked out of the system," Sherwood said.

Previously, problems with passwords occurred anywhere from five to 15 times a day, costing the city as much as $35,000 annually in labor expenses, not to mention lost productivity, according to Sherwood.

The solution was an enterprise biometric security system from Identix. For less than $100,000, the city virtually eliminated security problems and costs related to network logons. Once the staff understood why the city was turning to biometrics, they quickly accepted the new security system. "Most approve of it," said Sherwood. "They dont have to remember their passwords, which relieves a bit of stress when they come [to work] in the morning, especially after a long weekend or a vacation."

Besides logon security, the systems features also include biometric authentication to encrypt files or folders, lock applications and create secure information packages for e-mail attachment delivery. Similar technology is being used in Spain so that citizens can withdraw social security benefits from ATM machines and kiosks. Floridas Supreme Court also has selected Identixs biometric system to secure its 650-seat wide area network.

Although biometric technology isnt perfect, IT managers like Sherwood say it provides an increased layer of assurance in a world where information may be the most valuable asset but is constantly vulnerable to attack. Whats important is that its easy to use and manage, and the costs keep dropping.

"Its not a cure-all to security problems, but we like it," Sherwood said.